updated api base controller to allow requests from anywhere (including localhost:8888)