Cross domain options

This will allow the API to be used within the browser, via something like `$.post('http://site.com/users/login', {...})`.

Disabled by default.