Adds a function to allow individual API paths to support CORS requests e...

...asily. The function sets headers necessary to allow cookie based authentication (include cookies in CORS request). Currently restricted to GETs.

Argument for having one presto install in `app`:

1. I searched for the `api.php` file by searching for `restrictTo` in Coda (because I am lazy).
2. Found the file and implemented the function ... it didn't work.
3. Started hypothesizing reasons the approach was flawed: CORS handshake mystery, etc?
4. Stepped back from crazy and tried setting the necessary headers directly in my API ... works fine: the problem is me, not CORS mystery.
5. Realized I was working in the wrong file.

You could argue this is just me being dumb :smile:  but it is annoying to have to keep track of two presto installs in `app`.

@bruce-alderson for review

@ngallagher87 so he is aware of this