add cross origin filter in order to allow ui calls from other domains