set Access-Control-Allow-Origin to "*"

Calling "Header set" multiple times consecutively does not work, as only
the last value is picked up by Apache.

Ideally this should be limited to the originating domain, but since we
don't have a reliable way to determine the origin domain at the moment
and we are dealing with redirection issues with the root domain, allowing
access to font files only from anywhere sounds like a reasonable workaround.

Of the major browsers only Firefox seems to respect this header value correctly.