Set CORS header on cache only if it has not been set already (fixes #2897)
enable static cache in tests
Fix check for Access-Control-Allow-Origin

And shuffle some lines around to make it clearer what the comment
governs.
Remove Access-Control-Allow-Origin after all

This was essentially a no-op, since gratipay.com would be the default
anyway.
Remove compiled assets during test teardown
don't hardcode the paths of assets, and remove them when starting instead
Merge pull request #2907 from gratipay/issue-2897

Set CORS header on cache only if it has not been set already (fixes #2897)