cleaned up CORS filter implementation