ADD: Access-Control-Allow-Origin header

I've added the Access-Control-Allow-Origin header so the js can access both domains from each one, using the [CORS](http://www.w3.org/TR/cors/) mechanism.