CSV should respect --cors and return cors headers

[simonw]

Otherwise tools like Vega can't load data via CSV.

[simonw]

Demo: go to https://vega.github.io/editor/ and paste in the following:

{
  "data": {
    "url": "https://fivethirtyeight.datasettes.com/fivethirtyeight/twitter-ratio%2Fsenators.csv?_size=max&_sort_desc=replies",
    "format": {
      "type": "csv"
    }
  },
  "mark": "bar",
  "encoding": {
    "x": {
      "field": "created_at",
      "type": "temporal"
    },
    "y": {
      "field": "replies",
      "type": "quantitative"
    },
    "color": {
      "field": "user",
      "type": "nominal"
    }
  }
}