Enable CORS

This enables Cross Origin Resource Sharing (CORS) on the API. This will allow [most browsers](http://caniuse.com/#search=cors) to make cross domain requests without needing to resort to JSON (which is limited due to security concerns).

There's definitely some opportunity to DRY up the tests but I didn't go there.