Add Access-Control-Allow-Origin

Add Access-Control-Allow-Origin to response headers for cross site access to REST API

This is a primitive version, other options may be to provide a configuration option similar to that for the authentication (id/pw) option on the lua REST forwarded.

Not sure if I have injected this header in all the required places.