fix CORS on events route