Return CORS headers when creating layergroups via GET

Closes #92
Includes testcase