fixed routes and cors