Ensure card endpoint sets correct CORS headers
Merge pull request #1438 from guardian/fix-cards

Ensure card endpoint sets correct CORS headers