consider allowing CORS requests for module files

[ghost]

I think that it’d be useful to allow web applications to depend on modules directly from the Herd (not having to serve some modules themselves).