change the variable name to `cors_header`