[api] allow cross site requests to api.