fix CORS settings declaration