A better cors setup?