added CORS support for API and APP. closes #17