took out second CORS enablement call