FIX: Access-Control-Allow-Origin header

This Access-Control-Allow-Origin beast is really strange, and not totally working the same on each browser, of course. As a problemproof measure, we try to answer only one domain, depending on the domain that was requested. It's kind of hackish, but it'll do it for now.