[map app] enable cors; #6