2.7.3 - add cors to rest api, closes #36