add cors filter

fyi @hgschmie