fix CORS support