CORS, better attribute routing