Set CORS headers for API
Allow direct embedding of API results in other sites.