refactor cors