Permits CORS access for the callmeback.justice.gov.uk domain.

Background: We're in the process of modifying this app: callmeback.justice.gov.uk to return an out-of-office message during bank holidays. It seems to me that the easiest way to do this is to permit CORS access on your calendars app, and call it every time we need to retrieve the current list of bank holidays.

This may require you to modify your Varnish configuration to include the `Origin:` header in the cache key.