added CORS header to 2.0 API responses as per issue #232