Add CORS header to devserver.

Now that <script src="/turtlebits.js" crossorigin="anonymous"> has a cross-origin directive, the devserver won't work without an access-control-allow-origin header.  So this commit adds one.