chore(cors): allow cors on all routes for now