adding some settings for cross domain api requests - problably unsafe, but ok for the purpose