duplicate CORS directive in SSL section