creating new service - api.js
server - allow CORS