Add failing tests for CORS header

https://www.pivotaltracker.com/story/show/74243816

[#74243816]
Enable Cross Origin Resource Sharing CORS headers

In order for Javascript apps to be able to access the API from domains
other than `api.sealevelresearch.com`, we must enable Cross Origin
Resource Sharing. The server indicates to the browser that it's OK to
send requests here.

For now we're all totally unauthenticated so we've got quite lax
settings, and don't allow authentication.

https://www.pivotaltracker.com/story/show/74243816

[Delivers #74243816]