enabled CORS on all endpoints