Added AllowCors option and implementation (for cross domain API access)