allow cross-domain requests for API data calls (CORs)