fix check of parent resource in guard
make sure cuba_api uses only ONE response object per request. fix allow_origin response header
spec for guard