custom CORS middleware removed