added an origin header allowing access from anywhere to the token and owner end points to support javascript clients