Allow JS requests from other origins

Add "add_header 'Access-Control-Allow-Origin' '*';" option to the nginx config to allow html/js instances of the what's fresh mobile UI access to the API via javascript. Avoids CORS issues.
I think the idea there is that the risk of that header on a read only API is low, when compared with the risk of a more restrictive header breaking it in unforseen ways.