add cors capability accept origin=*