used withCORS variable instead of allowCORS method on the condition