fix CORS for api

Allow CORS allow only for API