extracted subway key and removed cors headers