82591368 allow cors

Updated application controller to handle CORS requests. This is so that the Navigator team can make requests from their Angular app.
Probably worth a comment here, if the `:null_session` setting is important.