enable cors for cards api url