add flag to configure CORS