charmstore: add CORS headers to all requests

To QA this, we need to create a web page that contains some javascript
that makes an AJAX request to the charm store, and check that it
succeeds.