cors filter is always the first one now & implicit as well
handle remote errors
add protocol to the host