try insert racks::cors before warden