try Nothing for CORS policy on normal requests.
refactor guard to match statement.

silences non-standard guard warning.