headers changed to cors to allow cross site api access