allow CORS, fixing client routes