Bug/fix cors

Where do you get variable `winning` here ?