apiserv: enable CORS

Use-case: client-side Web apps which use the API.