added cors in htaccess