Add cross-origin headers to all responses

This is an attempt at fixing #17. This is the first time I've ever looked at go code, so I just copied what I could find and hoped for the best, and I'm really not sure if what I've written is idiomatic or not. Also, there's no tests, sorry.