New: CORS support on the API (for developing against the API)

@Taloth @kayone 
I assume you're referring to the "Access-Control-Request-Headers" header being present?