tweak CORS configuration