Create allow.coffee

Add CORS headers to requests.