enable CORS API calls, no corresponding options call yet