add CORS and some minor cleanups