corsair

https://github.com/varvet/corsair

Corsair adds Access-Control-Allow-Origin to the response headers, even if your app raises an error.