remove whitelisted CORS