charmstore: add CORS headers to all requests