add patch to cors middleware