CORS for collections API (bug 901769)