separate the web client from  web server with CORS enabled