updated cors to allow requests from phone apps