Add Access-Control-Allow-Origin Header and OPTIONS method

[borispulyer]

Add Access-Control-Allow-Origin Header an allow OPTIONS requests to handle CORS preflight.