enable CORS

required for https://github.com/OpenRA/OpenRAWeb/pull/9