added Access-Control-Allow-Origin header to the API responses so we can allow Cross-origin resource sharing