Basic CORS support.

This patch adds an HTTP header of the form "Access-Control-Allow-Origin: *" to all responses in order to allow use in a cross-origin AJAX situation.

Note that this change allows the service to be used by everyone. I don't consider this a security issue as the current version already enables this behaviour by supporting JSONP.