Add CORS support

fixes #74
nah - forgot to strip that before pushing. already removed