added CORS headers for every REST endpoint
small refactoring