Switch over to using cors everywhere

Using a `XDomainRequest`-fiddled version of reqwest for now (https://github.com/ironsidevsquincy/reqwest)