Add Access-Control-Allow-Origin header to file response

[g-braeunlich]

This would be nice for e.g. serving wasm. If this header is missing, you will get

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://127.0.0.1:4000/file.wasm. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).