bugfix: bind CorsFilter as singleton