add a proxy so json requests can bypass the CORS requirement