add cors to reqs