add CORS headers on archive endpoint

https://github.com/juju/charmstore/issues/146
I'd make this more generic. Clients using the api might include browsers from 3rd party urls (such as a juju deployed juju-gui) and needs CORS support.