Unify whitespace in fakeserv.py and add Access-Control-Allow-Origin header

This will make it possible for people hack on the frontend without having to run their own backend at the same time.