CORS middleware
put splash middleware back in