add CORS http header so api can be accessed via ajax from other sites