allow CORS for api methods