add Access-Control-Allow-Origin header to API
Handle allowed CORS requests origins
Implement Allow-Methods and Allow-Headers, refactor isOriginAllowed
Merge pull request #111 from hybridgroup/176-cors-header

176 cors header