Here is a pre-release of the API Module. I've added the XID to the realtime web socket payload and also added the optional CORS headers.
To use the CORS headers take a look at the mangoApi/classes/mangoApiHeaders.properties file. Anything in the file not prefixed with # will be added as a name/value pair header for any mangoHost/rest/* URL
To enable the filter you will need to modify the web.xml file in the /web folder of the core. Check the mangoApiHeaders.properties file for the text to input. Just place that code (without the #'s prepending the lines) into that file near the <filter> section.
I realize this isn't ideal but for now it will have to work. Just remember that on every update of Mango's core you will need to replace these lines into the web.xml file. Hopefully by the next release this will be part of the core and not an issue for you.
Attachment: download link