changed session secret
added cors support for local dev