Use CORS

Closes https://github.com/nathan/phosphorus/issues/262.