add http:// to allow-origin