app setup, cors support