bugfix - using newer version of connect-cors