Added access-control-allow-origin headers

Added access-control-allow-origin headers, no longer sure if really
needed.