submissions.json: Enable CORS

There’s no reason not to allow CORS for public APIs. See http://annevankesteren.nl/2012/12/cors-101 for details.
Merge pull request #52 from mathiasbynens/patch-1

submissions.json: Enable CORS