tweaked and enabled cors in 1.4.7