Enable CORS 

This will allow client side code to use the JSON on the site. Currently only enabled for certificates, but this can be extended when we publish more data.

Fixes #482