Add CORS

Implementation untested
Replace manual CORS implementation with Rack::Cors.

Manually tested to verify