use the corshook to allow xsite requests
add the cors hook to the app