add cors middleware for get requests - closes #17

see #17