Guess I'll add a `cors_api_view` that wraps `api_view` and adds the CORS bits.