moved cors headers higher in stack