removed cors from middleware