Add CORS headers and allow browserid to authenticate client domain.