Added CORS decorator (closes #299) and cleaned up api.py