Allow CORS requests to the api