add middleware for cors requests