update for new CORS api