Added headers to API responses to allow cross-origin XHRs