Update package.json to use CORS 2.3.0