Allow CORS for the mobile/angular API invocation