decouple from server
allowing CORS