adds CORS and test endpoint