the cors configuration must be written in valid json