diff --git a/src/codebase/app.py b/src/codebase/app.py
index 2791ae7..6181336 100755
--- a/src/codebase/app.py
+++ b/src/codebase/app.py
@@ -12,7 +12,7 @@ def __init__(self):
         tornado_settings = {
             "xsrf_cookies": False,
             "gzip": True,
-            "debug": settings.DEBUG,
+            "debug": settings.DEBUG == "true",
             "secret_key": settings.SECRET_KEY,
         }
 
diff --git a/src/codebase/settings.py b/src/codebase/settings.py
index cb57d93..89d21f1 100755
--- a/src/codebase/settings.py
+++ b/src/codebase/settings.py
@@ -1,5 +1,6 @@
-DEBUG = True
-SYNC_DATABASE = True
+DEBUG = "false"
+CORS = "false"
+SYNC_DATABASE = "false"
 
 SECRET_KEY = "IpVDzxWOPQP9xxONJYdUHK1PNcyt4182Zulua6xfWkvZgp"
 
diff --git a/src/codebase/web.py b/src/codebase/web.py
index 5b863d1..99fb197 100755
--- a/src/codebase/web.py
+++ b/src/codebase/web.py
@@ -18,8 +18,8 @@
 class BaseHandler(tornado.web.RequestHandler):
     def set_default_headers(self):
         self.set_header("Access-Control-Allow-Origin", "*")
-        self.set_header("Access-Control-Allow-Headers", "x-requested-with")
-        self.set_header("Access-Control-Allow-Methods", "POST, GET, OPTIONS")
+        self.set_header("Access-Control-Allow-Headers", "*")
+        self.set_header("Access-Control-Allow-Methods", "*")
 
     def options(self):
         # no body
@@ -27,7 +27,7 @@ def options(self):
         self.finish()
 
 
-if settings.DEBUG:
+if settings.CORS == "true":
     MainBaseHandler = BaseHandler
 else:
     MainBaseHandler = tornado.web.RequestHandler
diff --git a/src/server.py b/src/server.py
index 14c96f2..ee3a5eb 100755
--- a/src/server.py
+++ b/src/server.py
@@ -47,7 +47,7 @@ def main():
     dbc.wait_for_it()
 
     # sync database
-    if settings.SYNC_DATABASE:
+    if settings.SYNC_DATABASE == "true":
         import_module(settings.MODELS_MODULE)
         dbc.create_all()