CORS support (closes #59)