merge CORS changes from trunk to 1.4 branch