Add CORS headers when origin is supplied

Adds a reasonable (not wide-open) set of CORS headers when an Origin header is set.

r @colinmarc ?