removed cors attribute