CORS support

Enables cross origin access to the API. (Fixes #711)
Does this splat work? Perhaps use `%r{}`?