move around the middleware since they got run by order and use cors module for cors