fix CORS for api

Allow CORS allow pnly for API