Allow CORS requests for mini manifests (bug 994423)

We tend to keep our import alphabetical and wrapped at 79 characters