Send CORS headers on xml requests

It looks like the wdn templates month widget uses the XML output, and is being blocked due to CORS