Add in cross domain decorator

- Allows us to decorate api routes with things like `@crossdomain(origin='*')`
- The scope of the crossdomain decorator is now just setting the `Access-Control-Allow-Origin` header.
- Applying this to the `fetch` method, without duplicating the other headers work done there
- Think it's probably good (and therefore worthwhile) to bundle up header/response stuff into the `core.response` module so that it can be shared out again.
![](http://31.media.tumblr.com/fe1890ae29e9beb133b96e45fb60da31/tumblr_n3fsc43Ini1qfg8sio1_500.jpg)