enabled cors for our client alone, exclude all else for all api endpoints