Setup `rack-cors` to talk to API

* Configurable through `ALLOW_ORIGIN` environment variable.