cors should be working