rack/cors fix 3