added allow-control-access-origin * in server.js