cors filter to enable file://