Added an Access-Control-Allow-Origin: * header so that AJAX requests would be accepted by modern browsers (welcome back XSS).