Access-Control-Allow-Origin and json Content-Type

`Access-Control-Allow-Origin` response header is required to access the
JSON endpoints from a browser which supports CORS via an XMLHttpRequest.
`Content-Type: application/json` is better for JSON responses than
`text/plain`.