added CORS middleware for cross origin API requests