diff --git a/web/modules/custom/etherpad_api/src/Client.php b/web/modules/custom/etherpad_api/src/Client.php
index 8600ebe..bfa5ac6 100644
--- a/web/modules/custom/etherpad_api/src/Client.php
+++ b/web/modules/custom/etherpad_api/src/Client.php
@@ -46,7 +46,8 @@ class Client {
   }
 
   /**
-   * Method description.
+   * Poizvedi na etherpadov API. Doda baseURL in verzijo pred zeljen url, doda
+   * API ključ in uredi parametre. Vendo je POST!
    */
   public function request($url, $opts = []) {
     $uri = "{$this->baseUrl}/" . self::API_VERSION . '/' . explode('?', $url)[0];
diff --git a/web/modules/custom/etherpad_api/src/Controller/EtherpadApiController.php b/web/modules/custom/etherpad_api/src/Controller/EtherpadApiController.php
index 884d43d..dc8bb0b 100644
--- a/web/modules/custom/etherpad_api/src/Controller/EtherpadApiController.php
+++ b/web/modules/custom/etherpad_api/src/Controller/EtherpadApiController.php
@@ -36,6 +36,8 @@ class EtherpadApiController extends ControllerBase {
     $data = array_merge($request->query->all(), $request->request->all());
     if ($data['padID']) {
       // @TODO prefix v config!
+      // Zahtevnejše ampak lepše bi bilo pa uporabit group API:
+      // https://etherpad.org/doc/v1.8.4/#index_creategroup
       $data['padID'] = 'yufu-' . $data['padID'];
     }
     $opts = ['form_params' => $data];
diff --git a/web/sites/default/default.services.yml b/web/sites/default/default.services.yml
index 8a6cdf2..a2eb26d 100644
--- a/web/sites/default/default.services.yml
+++ b/web/sites/default/default.services.yml
@@ -206,14 +206,14 @@ parameters:
   # for more information about the topic in general.
   # Note: By default the configuration is disabled.
   cors.config:
-    enabled: false
+    enabled: true
     # Specify allowed headers, like 'x-allowed-header'.
     allowedHeaders: []
     # Specify allowed request methods, specify ['*'] to allow all possible ones.
     allowedMethods: []
     # Configure requests allowed from specific origins. Do not include trailing
     # slashes with URLs.
-    allowedOrigins: ['*']
+    allowedOrigins: ['yufu.kompot.si', 'localhost']
     # Sets the Access-Control-Expose-Headers header.
     exposedHeaders: false
     # Sets the Access-Control-Max-Age header.