Support CORS on API calls

[qgustavor]

Supporting CORS on API calls, at least some of them, would be a good feature. Keybase supports it for user lookups and for Merkle tree related calls, so supporting it at least for user lookups will be great.

[qgustavor]

Looks like implementing this would modifying this file following documentation on CORS middleware and documentation on how to add middlewares to route groups. Should this issue be transferred to keys-ext repository? Can I send a pull request there implementing CORS support to /user/ API routes?