Add CORS headers to eventsource

EventSource (SSE) now has support for CORS in some browsers.
This patch will generate broken CORS headers as `Access-Control-Allow-Credentials` can not be set to `true` if `Access-Control-Allow-Origin` is set to `*`.