New: CORS support on the API (for developing against the API)

@Taloth @kayone 
Only add it if the request header actually exists.