server: add CORS handler middleware