Simple cors support.

This is a public read-only API so no harm in allowing all origns.