CORS enabled all routes