Add Timing-Allow-Origin to API response headers

[rviscomi]

Add the Timing-Allow-Origin: * header to the API responses to allow client-side monitoring to capture info about the API performance. This will let us see how often users are experiencing slow and heavy responses.