remove cors stuff - should be handled with nginx