Added cross-origin policy

Added cross-orgin-policy header so that the api can be accessed from client-side javascript.