Practice cross site

3 changes:

1. Don't force login for API calls
2. Send Access-Control-Allow-Origin: * header for API
3. Use question params instead of ID's