pkg: move cors.go to /pkg/cors.go