make 3rdparty folder readable for all, add cors route