added cross-origin headers for app API requests