added cors middleware

Enables CORS across the entire loopback application, using reasonable defaults.