Add CORS header to allow any origin.

We don't need CORS protection because we don't use cookies at all
(so a different origin cant exploit cookie saving to steal our
session).