dirty fix to allow CORS requests