fix bug, not returning response after CORS