CORS for angularJS and expressJS (with testing)