using django-cors-headers... see https://github.com/ottoyiu/django-cors-headers