don't send callback on cors