CORS for the api js