cross-domain quickfix

Access-control-allow-origin header in responses to allow cross-domain requests.