Add X-Client-ID as allowed CORS header

Alternative fix for #743
Revert "Update annotator-store to 5041bdc (for x-client-id header)."

This reverts commit 9f7ea374af2f76b78e0e7b4e851c4fea303e5721.