changed statement to omit CORS policy (kudos to pesche)