Enable CORS (closes #6)

Should work, fellas.