add CORS fiter and fix the work flow logic