* updated Rack CORS config