Added CORS enabled headers to controllers/api.js