only enable CORS for subscribe