_draft_ of cors middleware (wip)