Add CORS Headers to All the Things

Lots of endpoints need to let the browser do an OPTIONS header,
in order for the CORS stuff to work.