fix 3dr access-control-allow-origin