Install CORS bundle
add the /api prefix to routes to uniformly control the CORS