Move CORS to the security section