frontend only mode, access control allow origin