fixed CORS filter