All of the apis support CORS

Signed-off-by: Manson Li <manson.li@matchstick.tv>