added more cors checking before action