Added CORS to EPO query handling to work around EPO OPS API blacklisting of some Heroku servers; run EPO queries from dev server using cross-domain ajax with CORS.