adding CORS capabilities and accept JSON req