Allow any origin for accessing this REST call

I know wildcard isn't ideal but as this is an API call, I can't see a better way.