Allow AJAX cross-origin for API
Add user account public access in API