reordered version, controller res.headers for cors changed