added rack::cors to set all orrigins to allowed