diff --git a/packages/@nodepack/plugin-apollo/src/runtime/apollo-express.js b/packages/@nodepack/plugin-apollo/src/runtime/apollo-express.js
index f3eff8a..7238c57 100644
--- a/packages/@nodepack/plugin-apollo/src/runtime/apollo-express.js
+++ b/packages/@nodepack/plugin-apollo/src/runtime/apollo-express.js
@@ -39,17 +39,8 @@ hook('expressHttp', async (ctx) => {
     },
   }))
 
-  // Express middleware
   const graphqlPath = apolloConfig.path || '/graphql'
   server.setGraphQLPath(graphqlPath)
-  app.use(server.getMiddleware({
-    path: graphqlPath,
-    cors: config.cors,
-  }))
-
-  hook('expressCors', ctx => {
-    ctx.corsApplied = true
-  })
 
   // GraphQL Playground
   if (apolloConfig.playground !== false) {
@@ -61,6 +52,12 @@ hook('expressHttp', async (ctx) => {
     }))
   }
 
+  // Express middleware
+  app.use(server.getMiddleware({
+    path: graphqlPath,
+    cors: config.cors,
+  }))
+
   // Subscriptions
   server.installSubscriptionHandlers(httpServer)
 
diff --git a/packages/@nodepack/plugin-express/src/runtime/index.js b/packages/@nodepack/plugin-express/src/runtime/index.js
index 7031704..35c5977 100644
--- a/packages/@nodepack/plugin-express/src/runtime/index.js
+++ b/packages/@nodepack/plugin-express/src/runtime/index.js
@@ -26,10 +26,8 @@ hook('bootstrap', async (ctx) => {
 
   // CORS
   if ('cors' in ctx.config) {
+    app.use(cors(ctx.config.cors))
     await callHook('expressCors', ctx)
-    if (!ctx.corsApplied) {
-      app.use(cors(ctx.config.cors))
-    }
   }
 
   // Cookies
diff --git a/packages/@nodepack/plugin-passport/src/runtime/passport.js b/packages/@nodepack/plugin-passport/src/runtime/passport.js
index e5e8d4d..73e157d 100644
--- a/packages/@nodepack/plugin-passport/src/runtime/passport.js
+++ b/packages/@nodepack/plugin-passport/src/runtime/passport.js
@@ -25,7 +25,7 @@ export async function setupPassport (ctx) {
           serialized,
         })
       if (!user) {
-        done(null, false)
+        return done(null, false)
       }
       done(null, user)
     } catch (e) {