fix CORS missing options for firefox