Update README with links to the code that is being deployed.
Add CORS support in storage server nginx config.
Set Access-Control-Allow-Origin to the actual origin of the request, not "*".

This is more in-line with the expected handling of credential-bearing requests
and should not affect non-CORS requests.