cors added and documented