enable CORS

Added the rack-cors gem as middleware. Solves the cross-origin problems
we were seeing when the browser was making pre-flight requests before
PUT/POST/DELETE.