Cors

Fixes #10 although we need to add more nuance about the methods and headers accepted, probably on a per-resource basis.