Permit CORS for api.php