Allow cross-origin requests for JSON without having to use jsonp

[wdoug]

As a consumer of data from the data engine, I would like to be able to request data without having to deal with the annoyance of using jsonp to get around the fact that there are currently no CORS headers.

Access-Control-Allow-Origin: * might be the only one needed to be able to directly use the JSON endpoints.