fix issue 1 - strip api-id header on CORS request
fix issue 3 - remove responseBody on save