fix cors header
fix spell mistake