Allow fxpay headers via CORS (bug 1104371)

@andymckay r?
where is this sent in fxpay, I couldn't find it