Add basic CORS headers to allow cross-site access.

Add ¨Access-Control-Allow-Origin: *¨ to the HTTP headers of all replies.
This allows use in a cross-origin AJAX situation.

In compliance with the recommendations of section 4.2 of RFC2616, the header
is added before the existing entity headers.
compute turn penalties in lua profiles