tidy some debug statements, bring cors wrapper in