Send CORS headers

[roborourke]

There will likely be an extra step to whitelist the headers in Cloudfront but we should send an Access-Control-Allow-Origin header with the requesting domain as the value by default or read in from environment variables / config file.

Right now there are issues where images loaded via JavaScript won't work properly if the tachyon service runs on a separate domain.

[joehoyle]

In #162 we're removing the infrastructure (cloudformation template) and this is then up to the lambda configuration as to if someone wants to enabled it or not