Ensure card endpoint sets correct CORS headers

This fixes the cards CORS issues being seen in PROD.

/cc
@commuterjoy @kaelig