fixed CORS implementation/negotiation