added CORS configuration