added CORS security alert