Add CORSFilter

For x-domain capability - wire in a simple CORS filter.  Tested at
test-cors.org