api add CORS method