aaa wasteof api has strict cors