Try Access-Control-Allow-Origin: * for API responses.