Set Access Control headers for api.