add CORS middleware to add CORS header to *all* requests
requirejs-text now uses CORS XHR requests to static files