added CORS support middleware