code cleanups; CORS thanks to @jeromekelleher