Better CORS

I realized we didn't have CORS on the new APIs. That is a problem considering we want to use them from a client side app. The old version of the CORS addon also couldn't deal with anything except GET requests, since it couldn't deal with preflighted requests. This updates the CORSMixin class to deal with mixins, and adds it to the Questions and Answers API. All of the buddyup APIs should have this mixin.

r?