don't send payload if CORS invalid