fix CORS for heroku 2