set "Access-Control-Allow-Origin: *" on raw block/tx requests

Due to same-origin policy, JavaScript apps can't properly process the response of XMLHttpRequest if it doesn't have the Access-Control-Allow-Origin header.