permit CORS for the JSON API