working skeleton with cors