New: CORS support on the API (for developing against the API)

@Taloth @kayone 
yes, otherwise you'll add an empty response header.