code style
full CORS support and masking of application errors from API consumer