add cors middleware before warden