Set CORS headers for API

Allow direct embedding of API results in other sites.