Allow JS requests from other origins

Add "add_header 'Access-Control-Allow-Origin' '*';" option to the nginx config to allow html/js instances of the what's fresh mobile UI access to the API via javascript. Avoids CORS issues.
Do we want to make this configurable? Is ``*`` only needed for development but also for prod?