CORS headers

Fixes #282