clean up cors to only set headers when appropriate