Access-Control-Allow-* headers for CORS - closes #797