oops
enable CORS
merge master
must now be logged in to access API