remove forgery protection for CORS