Cors filter should only cover /api/*