fix cors middleware insertion to use valid middleware in production config