made cors enabled
fixed iframe params