Allow CORS requests for mini manifests (bug 994423)

Since assertCORS() from [`apps/amo/tests/__init__.py`](https://github.com/mozilla/zamboni/blob/master/apps/amo/tests/__init__.py#L425) wants to have OPTIONS in Access-Control-Allow-Methods too, should I modify [`apps/amo/decorators.py`](https://github.com/mozilla/zamboni/blob/master/apps/amo/decorators.py#L201) to add that? Or should I just write a test without using that function?