CORS refactoring