Enabling CORS on API

Signed-off-by: PulsarBlow <pulsarblow@gmail.com>