enable CORS by default