Fix #228 - Use CORS to allow people to request the legacy JSON API