rack_cors now inserts its self after Rack::Lock