fix: CORS enable personae routes