Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotations.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotations.java	(revision 88)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotations.java	(revision 91)
@@ -55,8 +55,4 @@
 public class AnnotatorAnnotations extends AnnotatorResourceImpl {
 
-    protected String getAllowedMethodsForHeader() {
-        return "OPTIONS,GET,POST,PUT,DELETE";
-    }
-
     /**
      * GET with JSON content-type.
@@ -68,5 +64,4 @@
     public Representation doGetJSON(Representation entity) {
         logger.fine("AnnotatorAnnotations doGetJSON!");
-        setCorsHeaders();
         // id from URI /annotations/{id}
         String id = null;
@@ -165,6 +160,4 @@
     public Representation doPostJson(Representation entity) {
         logger.fine("AnnotatorAnnotations doPostJSON!");
-        // set headers
-        setCorsHeaders();
 
         // do authentication TODO: who's allowed to create?
@@ -220,5 +213,4 @@
     public Representation doPutJSON(Representation entity) {
         logger.fine("AnnotatorAnnotations doPutJSON!");
-        setCorsHeaders();
         // id from URI /annotations/{id}
         String jsonId = (String) getRequest().getAttributes().get("id");
@@ -283,5 +275,4 @@
     public Representation doDeleteJSON(Representation entity) {
         logger.fine("AnnotatorAnnotations doDeleteJSON!");
-        setCorsHeaders();
         // id from URI /annotations/{id}
         String jsonId = (String) getRequest().getAttributes().get("id");
Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByResources.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByResources.java	(revision 88)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByResources.java	(revision 91)
@@ -50,12 +50,8 @@
  */
 public class AnnotatorAnnotationsByResources extends AnnotatorResourceImpl {
-    protected String getAllowedMethodsForHeader() {
-        return "OPTIONS,GET";
-    }
 
     @Get("json")
     public Representation doGetJSON(Representation entity) {
         logger.fine("AnnotatorAnnotatonsByResource doGetJSON!");
-        setCorsHeaders();
 
         // do authentication
Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByTags.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByTags.java	(revision 88)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByTags.java	(revision 91)
@@ -49,12 +49,8 @@
  */
 public class AnnotatorAnnotationsByTags extends AnnotatorResourceImpl {
-    protected String getAllowedMethodsForHeader() {
-        return "OPTIONS,GET";
-    }
 
     @Get("json")
     public Representation doGetJSON(Representation entity) {
         logger.fine("AnnotatorAnnotatonsBytag doGetJSON!");
-        setCorsHeaders();
 
         // do authentication
Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorGroups.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorGroups.java	(revision 88)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorGroups.java	(revision 91)
@@ -48,7 +48,4 @@
  */
 public class AnnotatorGroups extends AnnotatorResourceImpl {
-    protected String getAllowedMethodsForHeader() {
-        return "OPTIONS,GET";
-    }
 
     /**
@@ -64,5 +61,4 @@
     public Representation doGetJSON(Representation entity) {
         logger.fine("AnnotatorGroups doGetJSON!");
-        setCorsHeaders();
         // get user from auth token (preferred)
         Person authUser = getUserFromAuthToken(entity);
Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResourceImpl.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResourceImpl.java	(revision 90)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResourceImpl.java	(revision 91)
@@ -45,8 +45,7 @@
 import org.json.JSONException;
 import org.json.JSONObject;
+import org.restlet.data.Header;
 import org.restlet.data.Status;
-import org.restlet.data.Header;
 import org.restlet.representation.Representation;
-import org.restlet.resource.Options;
 import org.restlet.resource.ServerResource;
 import org.restlet.util.Series;
@@ -77,8 +76,4 @@
     private AnnotationStore store;
 
-    protected String getAllowedMethodsForHeader() {
-        return "OPTIONS,GET,POST";
-    }
-
     protected AnnotationStore getAnnotationStore() {
         if (store == null) {
@@ -106,42 +101,4 @@
             return null;
         }
-    }
-
-    /**
-     * Handle options request to allow CORS for AJAX.
-     * 
-     * @param entity
-     */
-    @Options
-    public void doOptions(Representation entity) {
-        logger.fine("AnnotatorResourceImpl doOptions!");
-        setCorsHeaders();
-    }
-
-    /**
-     * set headers to allow CORS for AJAX.
-     */
-    protected void setCorsHeaders() {
-        Series<Header> responseHeaders = (Series<Header>) getResponse().getHeaders();
-        if (responseHeaders == null) {
-            responseHeaders = new Series<Header>(Header.class);
-            getResponse().getAttributes().put("org.restlet.http.headers", responseHeaders);
-        }
-        responseHeaders.add("Access-Control-Allow-Methods", getAllowedMethodsForHeader());
-        // echo back Origin and Request-Headers
-        @SuppressWarnings("unchecked")
-        Series<Header> requestHeaders = (Series<Header>) getRequest().getAttributes().get("org.restlet.http.headers");
-        String origin = requestHeaders.getFirstValue("Origin", true);
-        if (origin == null) {
-            responseHeaders.add("Access-Control-Allow-Origin", "*");
-        } else {
-            responseHeaders.add("Access-Control-Allow-Origin", origin);
-        }
-        String allowHeaders = requestHeaders.getFirstValue("Access-Control-Request-Headers", true);
-        if (allowHeaders != null) {
-            responseHeaders.add("Access-Control-Allow-Headers", allowHeaders);
-        }
-        responseHeaders.add("Access-Control-Allow-Credentials", "true");
-        responseHeaders.add("Access-Control-Max-Age", "60");
     }
 
Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResources.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResources.java	(revision 75)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResources.java	(revision 91)
@@ -49,7 +49,4 @@
  */
 public class AnnotatorResources extends AnnotatorResourceImpl {
-    protected String getAllowedMethodsForHeader() {
-        return "OPTIONS,GET";
-    }
 
     /**
@@ -63,5 +60,4 @@
     public Representation doGetJSON(Representation entity) {
         logger.fine("AnnotatorResources doGetJSON!");
-        setCorsHeaders();
 
         String jsonId = (String) getRequest().getAttributes().get("id");
Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorRestlet.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorRestlet.java	(revision 89)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorRestlet.java	(revision 91)
@@ -23,5 +23,9 @@
  */
 
+import java.util.Arrays;
+import java.util.HashSet;
+
 import org.restlet.Restlet;
+import org.restlet.engine.application.CorsFilter;
 import org.restlet.routing.Router;
 
@@ -32,5 +36,5 @@
 public class AnnotatorRestlet extends BaseRestlet {
 
-    public final String version = "AnnotationManagerN4J/Annotator 0.5.0";
+    public final String version = "AnnotationManagerN4J/Annotator 0.5.1";
 
     /*
@@ -41,8 +45,7 @@
     @Override
     public Restlet createInboundRoot() {
-        // this.authenticator = createAuthenticator();
 
         Router router = new Router(getContext());
-
+        
         router.attach("/annotations", AnnotatorAnnotations.class);
         router.attach("/annotations/{id}", AnnotatorAnnotations.class);
@@ -56,8 +59,17 @@
         router.attach("/resources/{id}/annotations", AnnotatorAnnotationsByResources.class);
         router.attach("/", AnnotatorInfo.class);
+        //return router;
+
+        // this.authenticator = createAuthenticator();
         // authenticator.setNext(router);
         // return authenticator;
 
-        return router;
+        // handle Cross-Origin-Resource-Security headers
+        CorsFilter corsFilter = new CorsFilter(getContext(), router);
+        corsFilter.setAllowedOrigins(new HashSet<String>(Arrays.asList("*")));
+        corsFilter.setAllowedCredentials(true);
+        corsFilter.setNext(router);
+        return corsFilter;
+
     }
 
Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java	(revision 89)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java	(revision 91)
@@ -1,5 +1,2 @@
-/**
- * Implements the "search" uri of the Annotator API.
- */
 package de.mpiwg.itgroup.annotations.restlet;
 
@@ -52,8 +49,4 @@
 public class AnnotatorSearch extends AnnotatorResourceImpl {
 
-    protected String getAllowedMethodsForHeader() {
-        return "OPTIONS,GET";
-    }
-
     /**
      * result for JSON content-type. optional search parameters: uri, user, limit,
@@ -66,5 +59,4 @@
     public Representation doGetJSON(Representation entity) {
         logger.fine("AnnotatorSearch doGetJSON!");
-        setCorsHeaders();
         // do authentication
         Person authUser = getUserFromAuthToken(entity);
Index: src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorTags.java
===================================================================
--- src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorTags.java	(revision 75)
+++ src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorTags.java	(revision 91)
@@ -1,5 +1,2 @@
-/**
- * ReST API for accessing groups in the Annotation store.
- */
 package de.mpiwg.itgroup.annotations.restlet;
 
@@ -49,7 +46,4 @@
  */
 public class AnnotatorTags extends AnnotatorResourceImpl {
-    protected String getAllowedMethodsForHeader() {
-        return "OPTIONS,GET";
-    }
 
     /**
@@ -65,5 +59,4 @@
     public Representation doGetJSON(Representation entity) {
         logger.fine("AnnotatorGroups doGetJSON!");
-        setCorsHeaders();
 
         String jsonId = (String) getRequest().getAttributes().get("id");
