SpotsController allowing CORS also from the staging domain.