add cors support
lock in our current variant
add lower retention level
let's try this ordering and regex
merge with upstream