allow CORS options to be set in config