add django-cors to deal with Access-Control-Allow-Origin