Enable CORS

So client side apps can access the API without JSONP. I'm not sure how this will work if apps request the redirecting URL from the
 frontend, so we may want to think about proxying to /api (similar to how GDS do it). @pikesley - what do you think?