Allow any CORS.

This is so the server can serve on port 3001, while browser-sync serves at port 3000,
proxying the server. The server still gives out hypermedia links to port 3001, and this
change makes it so the client can make those AJAX requests directly to port 3001.