Change to W3C CORS header

Access-Control: allow <*>" seems deprecated. Updating to the CORS header now adopted by all major browsers per http://en.wikipedia.org/wiki/Cross-origin_resource_sharing