Add some more CORS headers.  Hack it till it works.