The /actions and /events endpoints must also response with Content-Type application/json and allow CORS