updated for Cross Origen Resource Sharing

This should probably be pushed into Phoserver as well.