try new CORS config