add cors headers to the query api.
get rid of the field types.