Re-add cors + add tests to prevent accidental deletion