Updated vagrant startup command documentation, added cross-site permissions header to API