Calendar API needs Access-Control-Allow-Origin

[PesiTheWizard]

Trying to fetch https://www.pychess.org/api/calendar with JS leads to not being able to use the result due to the lack of an Access-Control-Allow-Origin header in the response. This is despite the fetch returning 200 OK and the returned data being visible in the network monitor.

The same is true of https://www.pychess.org/api/games.

[gbtami]

Yes, we should use https://github.com/aio-libs/aiohttp-cors instead of our custom on_prepare() I think.