make /events/json accept CORS requests