allowed cors; dynamic backend endpoint