added CORS response headers, private params, and API controller