Add Access-Control-Origin

We can restrict this to Code Club World domain when the API goes live.