remove commented code about CORS