Yes, but the format is simpler than what you imagine; you just need to do this:
print "Content-Type: application/json"
print "Access-Control-Allow-Origin: *"
print
print json.dumps(features)
Basically, no further magic happens on what you put inside the quotations marks there—it’s just a literal string that’ll get sent as-is as part of the response.
In other words, the headers of an HTTP response are plain text, just like the JSON data that json.dumps(features) is putting into the response body.
The only magic is pretty simple: The way you know which part of the response is the headers and which part is the body is that there’s an empty line (extra newline) before the start of the body; everything before that newline is treated as headers by browsers and other web clients—so you can put whatever you want there, and the web server will just send it literally as-is.