add CORS header

This doesn't conform to the real Chef server behavior (yet), but it does allow you to use Chef Zero in a web browser, with jQuery, for example:

```js
$.get('http://localhost:4000/nodes/desktop').then(function (data) { console.log(JSON.stringify(data)) });
// {"name":"desktop","json_class":"Chef::Node","chef_type":"node","chef_environment":"staging","override":{},"normal":{},"default":{},"automatic":{},"run_list":[]} 
// TADA!
```

Wasn't sure where to put a test for this. Where would that be?