put CORS filter before security filter