added header "Access-Control-Allow-Origin:*" so this API can be easily tested as the content server is not yet ready