cors config to allow delete