consolidating into only one cors config param