Add CORS support

fixes #74
I don't have access to the logs so not sure what's already being logged. Is it useful and typical to log the response headers?