add tests and cors-friendly JSON webservice