second attempt to fix CORS problem