blip: implement CORS support for API requests