add Access-Control-Allow-Origin with all hosts to all API endpoints