add cross origin access; will need to tune this more