Add CORS support

This will close #122, and allow other domains to access this API. (So it's possible to make browser clients)