dont uppercase cors to easily use it from routes