Wrote tests and used 'node-cors' middleware to make them pass.
Merge branch '1-cors-headers' into dev -- closes #1