use manual control for CORS.