updated routes and cors conifig to allow * access in api endpoints