Add CORS headers for the v2 API.

Create a decorator for adding Cross-Domain headers, then use it
to allow CORS requests from any domain in the `api2` app.

This addresses issue #157