CORS error with graphQuery