assets and middleware for CORS