fix CORS for heroku 4