Replaced the public API by an authenticated API using an API key. This "new' API is CORS-proof.