separate web client from web server with CORS enabled