added and removed CORS