allow CORS in /*.json methods