add cors support in application_controller