Merge pull request #1580 from NatTuck/allow-api-xss

Allow cross site requests for API paths.