using cors instead of headers