cors update for mobile app