moved CORS filter to contains, same for OPTIONS