Add rudimentary mechanism for injecting CORS headers

This is super simple, and can stand to be better separated into a generic frontend, but it's the minimum needed to start pointing [swagger-ui](https://github.com/swagger-api/swagger-ui) at our API.