added cors to public routes