submissions.json: Enable CORS

There’s no reason not to allow CORS for public APIs. See http://annevankesteren.nl/2012/12/cors-101 for details.