fixed cors config for prd