CORS allow * on every route