Allow CORS requests for API controllers.
Some better tracking for events (target text, keycodes, actions).