allow ajax calls on api