Enable CORS for the 404 error page

[oeway]

After #177 and #182 , BinderHub API can be accessed from another origin, which is great. However, I noticed that if there is an error, the access-control-allow-origin: * header won't be send. The subsequent operation will be blocked, and the js code won't even know it's a 404 response.

It also triggers a series of error messages in the console if the kernel is dead and we keep requesting for example https://hub.gke.mybinder.org/user/oeway-cellpose-bifgkoq9/api/kernelspecs?1581014837233.

Access to fetch at 'https://hub.gke.mybinder.org/user/oeway-cellpose-bifgkoq9/api/kernelspecs?1581014837233' from origin 'https://lib.imjoy.io' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

I think it would be nicer if the 404 page can also allow CORS.