added Access-Control-Allow-Origin to try to enable cross domain json call