Set CORS header for public information (fixes #78).

This doesn't set headers on listings and search results. Should it?