working cors and api