cors inject zaproxy script