expand CORS route matching