use Rack middleware for CORS support

The things I noticed being handled differently by [rack-cors](https://github.com/cyu/rack-cors) than what we had before are:

* `Access-Control-Allow-Origin` reflects the incoming `Origin`, instead of always being set to `*`.
* `Access-Control-Allow-Headers` will [reflect what is passed to `Access-Control-Request-Headers`](https://github.com/cyu/rack-cors/blob/v0.2.9/lib/rack/cors.rb#L197), instead of always being set to `X-Requested-With, X-Prototype-Version`.

I don't anticipate either of these being a problem, but let me know. @adelevie Curious to hear your thoughts on the whole thing.
^ Required headers for CORS preflight requests.