fixes bug 924965 - enable CORS on the API

@lonnen r?