CORS custom header fix