enable CORS for the API
Merge branch 'hotfix/missing-cors'