Actually get CORS working properly

The `sinatra-cross_origin` gem doesn't work.