django-cors-headers added, plus api improvements