enable cors by default