Jormungandr: add CORS support

So it can call directly from a browser application.
But the headers are override by apache...