cors, really don't have time to fuck around today

@ostream it was another toxic docker issue... i was serving "localhost:8080" instead of "0.0.0.0:8080", apparently big difference... sigh

the tricky part is regardless of whatever the internal app is doing, docker will always show you 0.0.0.0:whateverport if you're exposing said port

took me a good few hours to hunt down