fixing default cors settings