Added CORS to private API