Allow CORS requests for mini manifests (bug 994423)

Would you mind adding a test verifying that these have the appropriate CORS headers? There should be plenty of examples of CORS tests.