feat(cors): quick and dirty solution for selective CORS