set access-control-allow-origin to *