Support for "Access-Control-Allow-Origin"

[cancan101]

Right now trying to use the browser (JS) SDK leads to:

XMLHttpRequest cannot load http://localhost:9324/.
No 'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'http://localhost:8000' is therefore not allowed access.
The response had HTTP status code 400.

i.e. the browser is preventing CORS.

See: https://coderwall.com/p/0izzta/cors-directive-for-spray
and: http://jkinkead.blogspot.com/2014/11/handling-cors-headers-with-spray-routing.html