Add CORS Access-Control header.

Have the MetricsServlet send back the Access-Control-Allow-Origin header so that the JSON output from the metrics servlet can be used in browser based dashboards separate from the application.