add middleware for cors which allow all