set Access-Control-Allow-Origin header for .woff fonts

Fixes cross domain issues with Firefox and custom fonts.

Firefox seems to opt for .woff fonts by default, which due to Firefox's
strict cross domain policies won't work with the current configuration.

For custom fonts to work in Firefox across domains, the
Access-Control-Allow-Origin header needs to explicitly allow access
from the domain the request originated from.