Added support for CORS

api.conf

@@ -5,6 +5,24 @@
 # The port to listen. Default is 3000.
 # port=
 
+# The Access-Control-Allow-Origin HTTP Header. It controls which origin
+# is allowed to access the API. You can allow all origins by setting it
+# to '*'. Default is '*'.
+# Note: This only affects access via JavaScript in browsers. Moreover,
+# a HTTP request is always sent when JavaScript in browsers attempts to
+# access the API, even when it runs on a domain that is not allowed in
+# 'allowOrigin'. In this case, however, the response is simply not made
+# accessible for JavaScript.
+# If the API is intended for access via a specific website, setting the
+# property to the domain of the site is strongly recommended.
+# Furthermore, note that this is not a protection for the API. It is 
+# simply a note for the browser to control which websites can access it.
+# In a non-browser context, this has no effect.
+# For an example, set it to 'http://example.com:8000' (NOT
+# 'http://example.com:8000/') if you want to access the API from
+# 'http://example.com:8000'.
+# allowOrigin=
+
 [docs]
 # The path for the Swagger UI documentation. If an empty path is
 # specified, no Swagger UI documentation will be available. Default is