Bug 816557: implement CORS correctly; r=mcote