add CORS headers to responses

[dyf]

To allow web apps to query this service, please add the following headers to all responses.

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: POST, GET
Access-Control-Allow-Headers: Content-Type