api: moving cors to api only
typo