fixed cors filter