feat(middleware): enable CORS