cors revisited
no cors