Allow all cross-origin requests

Since the API is read-only anyway, this just simplifies the creation of clients that interface with the API since they won't need to proxy through a server.