adding CORS to try and get some cross domain api calls working