followed EXPRESS docs on CORS