first try at adding CORS