Set up CORS hander for error responses

/to @ritch 

See https://github.com/strongloop/loopback/issues/575
cors middleware doesn't seem to compare the request url against the origin.