cors enabled in search