putting the cors stuff in a middleware. The previous version broke static routes for some reason