enables CORS on public routes
closes #91