adding minimalist CORS

For dealing with old browsers and IE :)
but I'm more and more convinced websockets-only support can be enough
[Per the specification:](http://www.w3.org/TR/cors/)

> The string "*" cannot be used for a resource that supports credentials.