Added CORS to routes