Added CORS to the api controller