modified cors to allow cross domain access