(#2540) - add referer to recommended cors headers

You actually need it for Chrome in web workers.
(I confirmed while testing PouchDB Server.)