detect whether to use cors