CORS support

Enables cross origin access to the API. (Fixes #711)
Good point. Maybe we should set that value in the config?