Enable Cross Origin Resource Sharing CORS headers

In order for Javascript apps to be able to access the API from domains
other than `api.sealevelresearch.com`, we must enable Cross Origin
Resource Sharing. The server indicates to the browser that it's OK to send
requests here.

For now we're all totally unauthenticated so we've got quite lax settings,
and don't allow authentication.

https://www.pivotaltracker.com/story/show/74243816