Set CORS headers on api controller actions
Disable X-Frame-Options for remote viewer login