12 nov feature
enable CORS by default