Fix allow-origin header that was broken by the yesod 1.2 changes.