Add in cross domain decorator

- Allows us to decorate api routes with things like `@crossdomain(origin='*')`
- Adds in test to the status feature, which is the only place this is being used currently
- Extends `core.response` — this felt like the right place
Reduce scope of the crossdomain decorator

- The scope of the crossdomain decorator is now just setting the `Access-Control-Allow-Origin` header.
- Applying this to the `fetch` method, without duplicating the other headers work done there
- Think it's probably good (and therefore worthwhile) to bundle up header/response stuff into the `core/response` module so that it can be shared out again.
Merge pull request #335 from alphagov/crossdomain

Add in cross domain decorator