refs #6122 Adding CORS header to Overlay controller methods since they are meant to be loaded from other domains where the overlay takes place.