#2 add cors filter