updated headers

the @crossdomain decorator allows for a CORS style environment for
localhost