enable all cors requests for `/api/v1`