API needs to set `Access-Control-Allow-Origin: *` response header

[therealsamf]

We need the API to set this response header and pushed, at least while we're developing. I have no idea if it poses a security risk in production, but because our origin, while we're developing, is localhost, I can't load the data into the frontend code.

[cilki]

OK I see. I'll try to fix that tonight