(bug) add a middleware to allow cross origin