Allow cross-origin API requests

@jorilallo pls take a look