added CORS headers to all endpoints