Whitelist all Imbo headers in Access-Control-Allow-Headers

When working with CORS, you explicitly need to specify which headers to allow the client to read.

This PR ensures that the client can read all Imbo-related headers, such as X-Imbo-ImageIdentifier, along with any error messages, original image sizes and whatnot.