setup cross-domain and moved api to separate app