added response.headers["Access-Control-Allow-Origin"] = "*" to allow webapp on a different server to use the api