Add basic CORS headers to every response

This should definitely be replaced with a proper middleware that checks for
certain headers before adding CORS ones.