fix cors and cors unittests, fix #324