Getting CORS working, in this specific case the API is public to anyone to access ('*').
In this case this is okay.