adding CORS configuration. this will allow  CORS requests to the API endpoints
and block direct requests to the stats API