Bump TinCanJS for CORS commit