changed CORS default to true