cors for fonts, so firefox stays happy