use CORS middleware

Closes #40. /cc #12