publish now enables CORS by default