adding cors to controllers and check preflight route