new strategy using rack cors