Support CORS in APIs

@czue @dannyroberts