Always set CORS headers at beginning of API handler.

Change-Id: Icde9a74260c4bb919f09c3e10c6dd5f372ccdaec