allow JavaScript xhr cors to access /wordJson