proper CORS
fix deploy