added rack::cors to set all orrigins to allowed, updated doc