allow cross origin requests in development mode