Add CORS handler so that API calls can be called from browsers via Javascript