update cors to set header instead of sending emails