Add Access-Control-Allow-Origin header middleware

Fixes #3. Use the "Origin" header to specify what domain the request is
coming from. If that domain is approved
(https?://(localhost|dotdeploy.works)) it will include that origin in
the response headers.