modified CORs middleware