Add CorsMiddleware adding an Allow-Origin=* header

This is required due to the update of js.socialshareprivacy to 1.5 which
loads JSON translation files.

See docstring in CorsMiddleware for more details.