workaround for nginx/vagrant bug; remove CORS hoo-hah