Improvements to CORS implementation.

adding Access-Control-Allow-* headers even for GET requests and
resticted CORS to /api/* and *.json urls.