Set cross origin headers for static assets

This change is necessary because Firefox enforces same-origin policy
for web fonts.

Fixes #812