cors and routing, all together