showing species, restricting CORS to GET