Include Access-Control-Allow-Origin header in rsp

required for cases of browser-based requests originating from a domain
other than that of the running server. If the client code is hosted on a
CDN (as is the desired usage), then this is precisely the case