disable cors dependency and use middleware