Add CORS headers to eventsource

EventSource (SSE) now has support for CORS in some browsers.
I know this is not part of the pull request, but I thought it would be worth mentioning. Charset can be source of connection failures for EventSource: https://code.google.com/p/chromium/issues/detail?id=66666