cors update
local test
same domain test