Set CORS Headers on API requests

By setting Access-Control headers, the Prometheus metrics API can be
accessed by cross-origin javascript applications (e.g., an external
dashboard pulling Prometheus metrics).
Merge pull request #131 from bernerdschaefer/cross-origin-metrics

Set CORS Headers on API requests