setting Access-Control-Allow-Origin header and returning JSON response
xhr calls from javascript