fix: get pass cors