Reduce scope of the crossdomain decorator

- The scope of the crossdomain decorator is now just setting the `Access-Control-Allow-Origin` header.
- Applying this to the `fetch` method, without duplicating the other headers work done there
- Think it's probably good (and therefore worthwhile) to bundle up header/response stuff into the `core/response` module so that it can be shared out again.