fix interface binding, and enable CORS