Bug fix. hboxapi.herokuapp.com already gives valid json so remove JSON.stringify. Added headers to bypass CORS.