img SOP example and workaround via crossorigin attr

TODO:
- more specific CORS headers server-side
- target specific resources for CORS headers server-side?
- proxy workaround for images