pin "component/has-cors" to v1.0.2

Now "has-cors" pins "global" to v2.0.1 as well (should fix v0.6.x)