CORS up a route handler