Add needed CORS headers to support OPTIONS request

This is a standard "preflight" request sent by jQuery, followed by the
real POST with data. In this case, the server needs to explicitly
approve the header(s) and method(s) used.