cors working except current_user