Authorize cross origin requests.

Setting Access-Control-Allow-Origin header to * which should prevent these types of browser errors:

```
XMLHttpRequest cannot load http://recruiting-api.nextcapital.com/users/1/todos?api_token=my-api-token. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://my-awesome-domain.com' is therefore not allowed access.
```

This should make getting started integrating into the API much easier.

For reference, here is an example of a raw `XMLHttpRequest` made directly against the API from the browser.

```javascript
var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {

  if (xhr.readyState == 4 && xhr.status == 200) {
    console.log(xhr.responseText);
  } else {
    console.log("Something went wrong.");
  }
}
xhr.open('GET', 'http://api.nextcapital.com:3000/users/1/todos?api_token=mkYm3gV2fbMpJzfNc2YA', true);
xhr.send(null);
```