Moved CORS into separate module