CORS improvements and clean up