add cors and apiKey middleware