Add CORS header

So that the API can be accessed cross-domain by Javascript.