outsourced cors handling (use cors filter for this), use trackMessageSizeFilter now