re-added /locos and /eventtypes API calls
added log message about allowed CORS URL