extract CORS decorator into separate module