Server side cors handeling