allow CORS for STA

We currently do not allow cross origin access to the STA data. For portals like earth-data.de, we need to allow this.

Can be allowed for location /sta by adding add_header Access-Control-Allow-Origin *;. While this works, maybe a more restricted setting is needed?