adding get user route and header to cors