fix CORS for heroku 10