Add CORS support

fixes #74
I believe `content-type` is already allowed, I usually set `X-Requested-With` just in case. I'm not the most familiar with CORS though. I did a simple search and found this: http://www.html5rocks.com/en/tutorials/cors/#toc-adding-cors-support-to-the-server