Add CORS support

This will allow API access from browser windows in other domains.