CORS plugin: always allow all origins ('*')

When making requests by hand (from the command-line or whatever)
it can be confusing that RoboHydra doesn't set the
Access-Control-Allow-Origin header (it's set to an empty value,
which means "don't send"). As we're asking the client to not cache
anything, it should be fine to set Allow-Control-Allow-Origin to
'*' instead of the value of the client's Origin header.