handle request and cors