Allow all origins in runner & live.

This is a precursor to possibly allowing the runner to be distributed as a
standalone without JS Bin's chrome.