switched back to robust CORS