Add cors to package.json