Allow cross-origin requests to /api/devices