use cors filter by default (requires tomcat 7)