Allow JS requests from other origins

Add "add_header 'Access-Control-Allow-Origin' '*';" option to the nginx config to allow html/js instances of the what's fresh mobile UI access to the API via javascript. Avoids CORS issues.
staff.osuosl.org or *.osuosl.org, though I do think * is safe as well.