all endpoints and cors