Added CORS, changed list behaviour to return full objects