Add CORS headers to api

This needs to be tested, but it allows url's other than the controller to make api calls on the controller by setting CORS headers. I was having issues testing this locally but this should work :pray:. 
Are these the only headers you are using?