fix(cors): update headers of rq handler to allow calls from webapp

[lukqw]

This PR adds missing headers to the app.js event handler to allow requests from our webapp.