cors before filter
added rack-cors gem