configure CORS for /graphql end point so it can be used with e.g. Javascript