updated cors exclusion of log4j api