add Cors to GET and POST