fixed cors rights