nginx config: fix the access-control-allow-origin header