add CORS headers on archive endpoint

https://github.com/juju/charmstore/issues/146
Rather than duplicating this, how about defining a function, something like this perhaps?

    func allowThirdPartyEmbeddding(w http.ResponseWriter) { .... }