Support CORS

[aviflax]

http://www.w3.org/TR/cors/

[berg]

We will. Leaving this open to remind us to document it. (My mention of this in #6 was merely that I didn't want to rely exclusively upon CORS for cross-domain calls from API consumers.)

[voidfiles]

Done!