Add CORS headers to eventsource

EventSource (SSE) now has support for CORS in some browsers.