Add Access-Control-Allow-Origin header
Merge pull request #155 from sbrunner/cors

Should support  Access-Control-Allow-Origin header