set up CORS to download remote flows #3