note delete + cors options