discovered a pip package (django-cors-headers) that manages cors much better than the original code