adding cors
make it api requests only for now