Added CORS to controller