cors is now working