final patch of CORS