another attempt to fix CORS