Set Access-Control-Allow-Origin: * on API requests

This allows scripts from arbitrary sites to access API endpoints, and
only if the requests are unauthenticated.

See also:
https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS

Change-Id: I3b356fad9337ec79e3f69d402f918d14841249a0