avoid setting cors header when it's already set