add CORS middleware.  add some comments