move CORS to under outside function tags