CORS api and resource decorations