CORS support

Please add (maybe optional) support for CORS:
```
add_header Access-Control-Allow-Origin *;
add_header Access-Control-Allow-Methods: *;
```

**Rationale:**  
Browsers only follow redirects for different-origin requests if the CORS headers match.