Fixes for cross site scripting. Remember to remove before release.
Added check for the dev environment to enable CORS