remove cors and protect from forgery