setup CORS for our api