more small changes related to CORS and update_only_url