Allow CORS from *.

TODO: Limit to localhost and ra.hul.ag.