added CORS allowance to API [temp]