properly add Access-Control-Allow-Origin headers (closes #4)