Allow option to enable CORS headers sent in response

[Matt Miller]

No Access-Control-Allow-Origin CORS prevents usage from JS applications on other domains.

[Stefano Cossu]

Fixed in 5729ca4.