Really fixed the CORS for web api