allow cross-origin AJAX-requests for Angular web client