Added CORS header
Fixed CSRF issue with Chrome extension
Handle CORS OPTIONS method and added optional CORS headers