allow access to the api from the browser