Enable CORS for previews

See https://en.wikipedia.org/wiki/Cross-origin_resource_sharing

This avoid usage of the resource proxy where possible.