allowed cors for all endpoints