Fix CORS use of stash