got cors to work