img SOP example: less javascript

TODO:
- more specific CORS headers server-side
- target specific resources for CORS headers server-side?
- proxy workaround for images