Added Access-Control-Allow-Origin Headers

The previous version wouldn't actually work as a web API in JS,
because the Access-Control-Allow-Origin header was missing.  This
should rectify that problem.