changes on server to allow CORS