added rack cors for cross-domain ajax requests