Allow CORS requests for packaged apps' zip files

Here's another one, if you don't mind.