fixed improper CORs forwarding