add Access-Control-Allow-Origin as public header
add json_encode and json_decode to allowed callbacks
move nl2br and json_encode to template
include store_map (for single store map)