replace custom middleware with CORS middleware