Merge "Add Timing-Allow-Origin header for cross-domain API responses"