api request: relative path, oauth2 cors

Signed-off-by: Arnaud Richard <a.richard@webshell.io>