update on EmbedController to allow cors in all routes