create decorator to enable CORS