Add access control headers to api controller
Merge branch 'dev'