Currently for dev we've set CORS to allow `*` but we should restrict that to `www.tulsawebdevs.org` and `tulsawebdevs.org` only