Fix CORS validations