Access control allow origin

Fixed typo that prevented the access-control-allow-origin header from
being added to all responses.