adding minimalist CORS

For dealing with old browsers and IE :)
but I'm more and more convinced websockets only support can be enough