master: enable CORS

Lets browsers make requests to the helios api.
Merge pull request #321 from spotify/dano/cors

master: enable CORS