fix @cors_origin with @method_decorator