master: enable CORS

Lets browsers make requests to the helios api.