refactor cors handling