add Access-Control-Allow-Origin header to API

Access-Control-Allow-Origin: *