fix CORS for heroku 8