Fix missing CORS headers in responses

- Add default Access-Control-Allow-Origin header to "*"
- Add a standalone example