enable CORS for all domains