FIX: cors setting was broken

Some days I wonder why we bother taking a whole gem
dependency when 10 lines of code does the job right