Add CORS in non production and support basic query