Provide CORS for all requests (adding it to POST responses allows Javascript to read stuff).