added rewrite rule to allow cors