use plugin instead of hook for CORS