default stubs path is now ./api-stubs
CORS for all requests