Cors media images

Offline SUMO will need media images to be CORS'ed, so this is added and images are allowed to be gotten from anywhere.

Example (this is served from staging, which has this code):
http://jsfiddle.net/PN6KE/7/

Previously this is not possible as `.toDataURL()` will throw a security exception.