adds cors true to all routes