removed cors restrictions for testing