Cross-Origin access for the api

[cpebble]

I am trying to hook up a web app for displaying some stats.
Is there a reason CORS isn't set up to allow API access from other origins? It would be 10/10 very nice if at least read-only requests could be sent from any origin