cors filter requires another JAR