Added 'Access-Control-Allow-Origin' header to API responses

I simply added a decorator, any_origin, which we can add to functions, to allow requests in a browser from other domains to come through. Non-API pages are left unchanged.