lease cors restriction