Add CORS headers to api

This needs to be tested, but it allows url's other than the controller to make api calls on the controller by setting CORS headers. I was having issues testing this locally but this should work :pray:. 
There's a few others like X_DEIS_VERSION, X_DEIS_RELEASE et al