CORS handling by package cors