a simple proxy middle for CORS