add crossOriginPolicy drawer configuration to enable or disable CORS image requests

After #308, tile sources that do not support CORS are failing with:

```console
Cross-origin image load denied by Cross-Origin Resource Sharing policy.
Tile $.Tile failed to load: [URL]
```

This patch adds a configuration setting for the `crossOrigin` request, allowing the new behavior to be disabled (or, to add use-credentials).