code: def _setHeaders(self, request):
          
          request.responseHeaders.addRawHeader(b'content-type', b'application/json')
          request.responseHeaders.addRawHeader(b'Access-Control-Allow-Origin', b'*')
          request.responseHeaders.addRawHeader(b'Access-Control-Allow-Methods', b'GET, POST, PUT, DELETE')
          request.responseHeaders.addRawHeader(b'Access-Control-Allow-Headers', b'x-prototype-version,x-requested-with')
          request.responseHeaders.addRawHeader(b'Access-Control-Max-Age', 2520)
          return request
docs: Those headers will allow you to call API methods from web browsers, they require CORS:
              https://en.wikipedia.org/wiki/Cross-origin_resource_sharing