update cors origins to allow all