spiking on CORS