new cors filter needs a content type
removed manual cors settings, this is now done by the cors filter