moved CORS language from application controller to series controller