move the rack-cors middleware earlier in the chain