Made API more CORS-friendly, removed duplicate headers